GHSA-vpx7-vm66-qx8r
Path Traversal in github.com/unknwon/cae/zip
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/unknwon/cae | < 1.0.1 | 1.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
### Specific Go Packages Affected
github.com/unknwon/cae/zip
References
External links from the advisory. They lead to third-party sites.